OBJECT

This document has been prepared with the purpose of establishing the Management Procedure for Received Information, corresponding to the Internal Information System or Whistleblower Channel of this entity.

This Management Procedure respects and complies in all cases with the minimum requirements established by Law 2/2023, of February 20, regulating the protection of individuals who report regulatory violations and combat corruption.

SCOPE

This procedure applies to all notifications received through the Internal Information System or Whistleblower Channel of this entity.

RESPONSIBILITIES

3.1 - From the governing body of this entity/organization

• Designate a responsible person, hereinafter referred to as the “System Responsible,” to manage and process the notifications received through the Internal Information System, as well as their dismissal or termination.
• Both the appointment and the termination of the individual designated person, as well as the members of the collegiate body, must be notified to the Independent Authority for Whistleblower Protection, A.A.I. , or, where applicable, to the competent authorities or bodies of the autonomous communities, within their respective competencies, within ten business days, specifying, in the case of termination, the reasons that justified it.
• Likewise, and exceptionally, a substitute for the system responsible will be designated in case of their absence.
• Establish guarantees for the protection of whistleblowers within the entity or organization.
• Have a policy or strategy that outlines the general principles regarding Internal Information Systems and whistleblower protection, which should be properly publicized within the entity or organization.
• Approve this procedure.
• Keep this procedure updated.

3.2 - Regarding the System Manager

• Develop their functions independently and autonomously from the other bodies of the entity or organization. They shall not receive any type of instructions in their exercise and must have all the necessary personal and material means to carry them out.
• The System Manager will be responsible for the diligent processing of notifications received through the Internal Information System or Whistleblower Channel.
• To respect and ensure the proper compliance with this procedure.

RIGHTS AND GUARANTEES OF THE PARTIES

Any communication/report sent through the channels established in this procedure will enjoy total and absolute confidentiality.

In any case, this entity will prioritize and respect the right to the presumption of innocence and the honor of any of the parties involved in a communication/report, ensuring that the rights of any implicated party are not violated.

Throughout the investigation of a communication/report, the right of the affected person to be informed of the actions or omissions attributed to them will be guaranteed. However, the exercise of this right will be temporarily limited until the appropriate moment in order to ensure the successful conclusion of the investigation.

The respect for the provisions on personal data protection will be guaranteed in accordance with the provisions of Title V of Law 2/2023, of February 20, regulating the protection of individuals who report regulatory infringements and the fight against corruption.

This entity will inform users of the system in a clear and accessible manner about the external information channels to the competent authorities and, where applicable, to the institutions, bodies, or agencies of the European Union.

In particular, the whistleblower is informed that the individual whistleblower has the following External Information Channels available to them, and may use them in the same way as they use this Internal Channel:

• External Information Channel of the Independent Whistleblower Protection Authority, A.A.I. : “In development”.
• External Information Channel of the Autonomous Community: “Include access to the Complaints Channel of the specific Autonomous Community”.
• External Complaint Channel EU Law: https://commission.europa.eu/about-european-commission/contact/problems-and-complaints/complaints-about-breaches-eu-law-member-states/how-make-complaint-eu-level_es
• Information protection EU Law: https://commission.europa.eu/aid-development-cooperation-fundamental-rights/your-rights-eu_en

5.1 - Procedure for submitting complaints

The Complaints Channel allows two ways to submit complaints by the subjects who wish to do so, hereinafter referred to as users:

• Submitting complaints by identifying the subjects making the communications.
• Submitting anonymous complaints.

Submitting a complaint by identifying the complainant

Users will be able to make a communication/complaint by accessing through the link provided on the corporate website or through the mobile application Complaints Channel.

The access will require users to use access credentials "User" and "Password". These access credentials can be provided to users in two ways:

• Communicated by the System Administrator to Users individually, in the event that they have been registered beforehand through their access panel to the Reporting Channel.
• Credentials received by the User in their email once they have registered from the web access panel of the Reporting Channel.

Submission of anonymous report

Once the User accesses the link provided on the entity's website, they will be able to submit a report anonymously by clicking on the "Anonymous report" option.

The submission of the anonymous complaint will require filling in the SILBON ESPAÑA SLU field correctly and following the instructions provided in the User Manual for the Reporting Channel available from the entity.

5.2 - Receipt of the complaint, status acknowledgments to the complainant, and information exchange between the complainant and the System responsible

The System responsible will be able to manage and receive each of the complaints made by accessing them through the Complaints section within the web management system for complaints, accessible via the link provided on the entity's website.

To access this panel, the system responsible will need to identify themselves with their Username and Password, provided by the entity.

Within your area of work for receiving and managing complaints, you will be able to distinguish between complaints that are in process and those that have already been reviewed and managed.

Within the "In Process" section, the System Manager will have all received complaints available for management, being able to differentiate whether they are complaints from identified Users with their first and last names, as well as those that are anonymous, the date of receipt or registration of each complaint, the number of days it has been open, as well as the status it is in.

The different statuses that complaints in process can have are:

• Received: the complaint has arrived, but no action has been taken on it.
• In Progress: the work procedure on the complaint is in process.

Once a report is received by the System Responsible, the mandatory acknowledgment of receipt will be communicated to the complainant as soon as possible and, in any case, within a maximum period of 7 calendar days from the receipt, unless in those cases where this may jeopardize the confidentiality of the communication.

Once the System Responsible communicates the acknowledgment of receipt to the complainant, they will receive a notification informing them that it has been received via the email provided in their user profile within the system.

In the case of a non-anonymous report, the complainant will be able to see the status of their report from the "Access Anonymous Report" section and through the tracking code provided to anonymous Users at the time of submitting their reports.

The stages of processing in which a complaint can be found are:

• Received: the complaint has arrived, but no action has been taken on it.
• In Progress: the work procedure on the complaint is in process.
• Processed: the complaint has been successfully managed.

Any change in the status of the complaints made by the System administrator will be notified to the complainant who was identified when submitting the complaints via their email. This will always be provided that the User is allowed to receive notifications of status change acknowledgments via email.

As previously mentioned, the communication of the acknowledgment of receipt to the complainant by the System Manager, as well as any other status changes that the Manager wishes to make regarding each complaint, will be carried out through the "Notifications" section within the complaint management panel of this.

The following complaint processing statuses can be communicated to the complainant:

• Notify complaint received.
• Notify complaint in process.
• Notify resolution of the complaint.

The system will record the notifications made to the complainant, noting the date of sending, and will inform the System Manager if it has been received and read by the complainant through their access to the online system.

Likewise, the System Administrator may modify the content of the message sent to the complainant when changing the status of each complaint.

5.3 - Handling of the Complaint

The System Administrator, once they have notified the complainant that the complaint is being processed, will begin the investigation and development of the same.

The maximum period to respond to the investigative actions shall not exceed three months from the receipt of the communication or, if no acknowledgment of receipt was sent to the informant, three months from the expiration of the seven-day period after the communication was made, except in cases of special complexity that require an extension of the period, in which case it may be extended for a maximum of an additional three months.

Through the system, you will have the option to process the complaint, as well as to issue a report and send it to the management bodies of the entity.

During the management of the complaint, there is the possibility of maintaining communication with the informant and, if deemed necessary, requesting additional information from the informant. This option can be carried out both through external means and through the channels enabled in the Complaint Channel via the "Chat" button available in each of the received complaints.

In any case, the information contained in the complaint, or that which may be obtained during the investigation, will be immediately communicated to the Public Prosecutor's Office when the facts may be indicatively constitutive of a crime. In the event that the facts affect the financial interests of the European Union, it will be forwarded to the European Prosecutor's Office.

5.4 - Completion of the complaint

Once the study and investigation of the complaint have been completed, the System Responsible will communicate the acknowledgment of status to the complainant through the option “Notify resolution of the complaint”.

This notification of resolution of the complaint will, in no case, inform the complainant of the internal result of the investigation.

At the moment the complaint is finalized, it will be listed in the Reviewed Complaints section within the Complaints section, being completely blocked from that point on and unable to be modified by any means.

5.4 - Reception of complaints through other channels

When the communication/complaint is sent through reporting channels that are not established or is directed to staff members not responsible for its handling, who have been trained in this matter and warned of the classification as a very serious infringement of its breach, the recipient of the communication must immediately forward it to the System Responsible.

Notwithstanding the above, this type of communication will enjoy the same confidentiality as if it were a complaint sent through the established channels in the entity.

GENERAL PRINCIPLES POLICIES REGARDING THE INTERNAL INFORMATION SYSTEM AND WHISTLEBLOWER PROTECTION

INTRODUCTION

The Policy of general principles regarding the Internal Information System and whistleblower protection, hereinafter referred to as the Policy, aims to establish a solid foundation intended to promote the proper use of the Internal Information System of this entity, as well as to ensure comprehensive protection for the whistleblower.

SCOPE

This policy applies generally and integrally to this entity.

The principles of protection and defense of the whistleblower included in this policy will apply to whistleblowers in accordance with the provisions of Law 2/2023, of February 20, regulating the protection of individuals who report regulatory violations and combat corruption.

PRINCIPLES OF THE POLICY

This Policy aims to comply with the obligations contained in Law 2/2023, of February 20, regulating the protection of individuals who report regulatory violations and combating corruption.

Based on the legal content imposed in the aforementioned Law, this entity is firmly committed to:

• Maintain a control mechanism that supports internal processes to improve and maintain the quality of the Internal Information System.
• Ensure that all communications made through the Internal Information System will be addressed.
• Develop and maintain transparent policies and procedures for all key data processed through the Internal Information System.
• Implement measures and introduce appropriate mechanisms to ensure the security of the information transmitted through the Internal Information System, as well as to strengthen and guarantee the protection and defense of the whistleblower.
• Provide advice, training, and support to staff as necessary regarding both the use and promotion of the Internal Information System and the defense of the whistleblower.
• Ensure that the policies for the use and operation of the Internal Information System, as well as the promotion of whistleblower protection, will have the commitment and support at all levels of the entity so that they can be coordinated and integrated with the rest of the strategic initiatives to form a completely coherent and effective working framework.
• Ensure the non-disclosure of the data included in the communications carried out through the Internal Information System.
• Restrict access to the data included in communications carried out through the Internal Information System.
• Strictly comply with each and every one of the measures included in Law 2/2023, of February 20, regulating the protection of individuals who report regulatory violations and combat corruption.

CONTROL AND COMPLIANCE WITH THE POLICY

The governing bodies of the entity will ensure the correct and appropriate compliance with the content of these Policies.